View Markdown

Documentation

agentrc is organized as a small set of stable documents rather than a monolithic application manual.

What is agentrc?

Start here: a Dockerfile-shaped recipe for portable, governed agents, the problem it solves, and why it is needed.

Specification

The full 0.1.0-draft.6 working draft: the four new keywords, the /mnt layout, build → ai.agentrc.* labels, and Cedar enforcement.

Quickstart

Write your first Agentfile, build it (BuildKit frontend or arc build), read the emitted labels, push, and run.

Demo: one agent, three backends

Build the code-reviewer agent once, then run the same artifact on three substrates — local microVM, Bedrock, and Kubernetes — via the reference translators.

Agentfile

The single-agent declaration: IDENTITY, CAPABILITY, SOP, POLICY over standard Dockerfile keywords.

Security

POLICY requests become ai.agentrc.* labels; the platform grants/narrows/rejects and enforces via Cedar, deny-by-default.

Package model

A standard OCI artifact: layers carry /mnt resources, the config carries ai.agentrc.* labels. Sign, mirror, review before run.

Runners

How a platform reads ai.agentrc.* labels (never the Agentfile) and a substrate executes CMD — without agentrc becoming a runtime.

Conformance

Profile-based conformance and the adversarial test suite that probes the fail-closed, deny-by-default guarantees a platform must uphold.

Implementation mapping

How today's reference-implementation modules line up with the 0.1.0-draft.6 Agentfile model, gaps called out honestly.

Reference implementation

The Go tooling/ that implements both build paths — try arc lint, the BuildKit frontend, and the emitted ai.agentrc.* labels.